Fireball – the inferno within

Posted 8th June 2017.

There are very few countries which emanate threats globally, with China being one of them. Fireball is a legitimate software since it is digitally signed by the very organization which has developed it, however it also bundles up malicious binaries and browser extensions.

Traditionally, ad-wares were never considered to be malicious, since their sole intention was to redirect traffic and bombard the user with advertisements, and furthermore, these ad-wares were always bundled with other legitimate software, so that unsuspecting users ended up installing them too. Besides, there exists Pay-Per-Install (PPI) revenue sharing model between the developers and the bundled software providers. Due to the fact that they piggyback on a popularity of legitimate software, this association is profitable for all the stakeholders.

Fireball, not just installs an ad-ware, but also manipulates the victims default browser search engine to fake ones, which in turn redirect the search query to Yahoo.com or Google.com. However, these fake search engines do a lot more than simple redirect, they track the users and they can spy on their victims too by dropping and executing malwares.

The concern around Fireball is that the adware it installs after downloaded to a device, is capable of installing malwares using backdoor. This in turn could be used by cyber criminals to exploit and use to push malicious codes or exploits to create large scale attacks or disruptions. Though adware installation by various software download applications are seen as an accepted practice by the end-users, however the Fireball issue could be different than what meets the eye, which is a huge concern with its largest install base of more than 250 million devices worldwide.

eScan’s Advisory suggests the below precautions to be implemented for such attacks in the ever growing complex cyber threat landscape:

– eScan recommends using an adware scanner to scan if
there is anything wrong with the browser
– Once you found the adware in the system, go to Programs
and Features list in the Control panel of Windows OS to
uninstall the program
– MacOS users should user finder to locate and uninstall the
application. After that empty the trash to delete the
compromised file
– Go to your browsers and explore tools and extensions to
uninstall anything suspicious
– Do a regular check for any unauthorized or suspicious
browser extensions and plug-ins to make sure your
homepage and search engine are the ones that you have
set
– Always opt for custom installation and then de-select
anything that is unnecessary or unfamiliar

The information provided above will help you to protect your system from being victim of Fireball malware.

About eScan:

eScan is an ISO (27001) certified pure play enterprise security solution company with over 2 decades of expertise in developing IT security solutions. eScan today has a presence in 12 countries through its offices and subsidiaries. It also boasts of a robust channel partner network of more than 50, 000 partners spread across 190 countries worldwide. It is trusted by more than 6,500 enterprise and corporate users spread across various industry segments such as Government, BFSI, Education, Defense, Telecom, IT & ITeS, Infrastructure, Hospitality, and Healthcare worldwide.

It is powered by some of the latest and innovative technologies, such as Proactive Behavioral Analysis Engine (PBAE) Technology, MicroWorld Winsock Layer (MWL) Technology, Domain & IP Reputation Check (DIRC) Technology, Non-Intrusive Learning Pattern (NILP) Technology, and sophisticated Anti-Virus Heuristic Algorithms that not only provide protection from current threats, but also provides proactive protection against the ever-evolving cyber threats. eScan provides 24×7 free remote support facility to help its esteemed users to provide real-time solutions for security related issues.

For more information, visit www.escanav.com

Press Contact

Name: Anshu Ahuja

Phone Number: 12483745020

Email Address: webpr@escanav.com

Submit your news to prfire.co.uk for FREE. Click the button to get started:

PR Fire is a leading online public relations and marketing service that will help you to spread your press releases and news by reaching customers and media. There are different services for different business needs - free and paid for. You can upload press releases onto our Google-friendly news site. We can help with press release distribution and send your news to the media outlets you want to target. We can even write the press releases you want to distribute.